Internal Audit
Quick facts
| Category | Self-assessment and continual improvement |
|---|---|
| Used by | Manufacturing, medical devices, pharmaceuticals, aerospace, automotive and other regulated industries |
| Also called | First-party audit |
| Related standards | ISO 9001, ISO 13485, AS9100, IATF 16949, ISO 19011 |
| Related processes | Audit management, CAPA, nonconformance, management review, document control |
| Semantic match | internal audit process, first-party audit, ISO 9001 internal audit, internal quality audit program |
What is Internal Audit?
An internal audit is a first-party audit, meaning it is performed by the organization on itself rather than by an outside customer or certification body. Trained internal auditors examine processes, records and practices to determine whether they conform to the organization's documented procedures, to applicable standards such as ISO 9001, and to customer or regulatory requirements.
Internal audits are planned in advance as part of an audit program that defines scope, criteria, frequency and responsible auditors. Auditors gather objective evidence through interviews, observation of work being performed, and review of records, then compare that evidence against the applicable requirements.
A defining requirement of internal audits is auditor independence. Auditors should not audit their own work, since doing so risks compromising the objectivity of the findings.
Why is Internal Audit important?
Internal audits give an organization an honest, structured look at whether its quality system works in practice, not just on paper. They frequently surface gaps between documented procedures and actual day-to-day practice before those gaps become customer complaints, regulatory findings or product failures.
Because internal audits are self-initiated, they allow an organization to find and fix issues on its own timeline, rather than waiting to be told by a customer or certification body. This proactive discovery is a core expectation of ISO 9001 and related standards.
Internal audit findings feed directly into corrective action and management review, connecting day-to-day process verification to leadership-level decisions about where to invest in improvement.
How does Internal Audit work?
A typical internal audit follows these steps:
- Program planning. Schedule audits across the year based on risk, importance and prior results.
- Scope and criteria. Define which process or area will be audited and against which requirements.
- Auditor assignment. Select a trained, independent auditor for the area being examined.
- Evidence gathering. Interview personnel, observe work, and review records and documents.
- Findings. Document conformances, nonconformances and opportunities for improvement.
- Reporting. Communicate results to relevant management without undue delay.
- Corrective action. Investigate and resolve nonconformances through the CAPA process.
- Follow-up. Confirm corrective actions were completed and effective before closing the audit.
Internal Audit vs. Management Review
| Comparison | Internal Audit | Management Review |
|---|---|---|
| Purpose | Verify conformance of processes and records to requirements | Evaluate the overall suitability, adequacy and effectiveness of the QMS |
| Performed by | Trained, independent internal auditors | Top management |
| ISO 9001 reference | Clause 9.2 | Clause 9.3 |
| Typical input to the other | Audit results are a required input to management review | May direct audit program priorities for the coming period |
Real-world examples of Internal Audit
A pharmaceutical manufacturer schedules an internal audit of its batch record process. The auditor finds that some entries are made after the fact rather than in real time and opens a corrective action to reinforce contemporaneous recordkeeping.
An electronics manufacturer's internal auditor reviews the calibration program and discovers several instruments are past their due date. The finding triggers an immediate containment action and a broader review of calibration scheduling.
A medical device company uses internal audit results, aggregated across a full year, to identify that training compliance is a recurring weak point across departments, prompting a management review discussion on training resources.
Regulations and standards related to Internal Audit
ISO 9001 Clause 9.2 requires organizations to plan, establish, implement and maintain an internal audit program that considers the importance of the processes involved, changes affecting the organization, and the results of previous audits, and to select auditors who ensure objectivity and impartiality of the audit process.
ISO 13485 and IATF 16949 carry similar internal audit requirements adapted to medical device and automotive quality systems, and AS9100 extends internal audit expectations to aerospace-specific processes. ISO 19011 provides widely used guidance on auditing management systems, including auditor competence and program management, though it is a guidance standard rather than a certifiable requirement.
Internal audit clause 9.2 has historically been among the more frequently cited nonconformances in ISO 9001 and AS9100 certification audits, often due to incomplete audit programs or auditors lacking independence.
Required by
How QT9 helps with Internal Audit
QT9 QMS internal audit capabilities
- Build and manage an internal audit schedule with automated reminders.
- Create custom checklists tailored to ISO, FDA or customer-specific requirements.
- Auto-generate CAPAs directly from internal audit findings.
- Assign auditors and track independence and competence records.
- Maintain a complete, timestamped audit trail for every internal audit.
- Report internal audit trends and overdue items on real-time dashboards.
Request an Internal Audit Demo Explore Audit Management Software →
See QT9 Software in Action
Discover how QT9 Software helps manufacturers improve efficiency, strengthen compliance and connect quality management and ERP processes within one integrated platform.
Common mistakes with Internal Audit
Common internal audit mistakes include assigning auditors to review their own work or department, which undermines objectivity, and treating the internal audit as a paperwork exercise rather than a genuine evaluation of practice.
Other problems include building an audit schedule that does not account for risk or prior findings, failing to report results to management without undue delay, and not following through on corrective actions once a nonconformance is identified.
Frequently asked questions
Related quality management terms
Related content
Ready to Transform Your Business?
See how QT9 Software helps manufacturers simplify operations, improve traceability and drive continuous improvement with integrated quality management and ERP software.